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IMPORTANT PRELIMINARY INFORMATION 


This statement has been shared to support fair and balanced reporting in relation to the investigation 
carried out at the University Hospitals Morecambe Bay NHS Foundation Trust, including allegations 
made around evidence tampering and transparency. The contents of this document have been taken 
directly from evidence previously submitted or reported for the independent investigation. Please 
approach Niche directly if any aspect of this statement requires clarification. Niche should also be 
contacted in advance of any reporting, where Niche should be offered a right of reply. This includes 
media publications, conferences and speaking events, podcasts, and any other publications where 
‘Niche’, the ‘Independent Investigation / investigators’, ‘discredited evidence’, ‘email/evidence tampering’, 
into urology at UHMB is mentioned. 


Niche has anonymised all references to the index patient (IP) and has also anonymised the names of 
other staff at UHMB, instead referring to them by role. 


Niche retains all rights over this document and of the information enclosed. 
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Introduction 


About Niche 


Niche is a small to medium sized company which is majority owned by its employees’. Niche is 
based in Manchester and specialises in undertaking independent investigations, analytical work, 
and assurance reviews. Over the last 32 years Niche has built a proud reputation for delivering 
professional review work which helps healthcare providers to improve the care they provide. Our 
staff are also extremely committed to supporting families who need answers about the care they, 
or a loved one have received; we recognise this as a fundamentally important part of our work. 


Niche undertakes regular independent investigations relating to whistleblowing and complex 
patient safety concerns. Many staff employed by Niche have previously worked within the NHS 
and we also sub-contract to a range of clinical professionals and subject matter experts where 
exacting, working (often clinical specialist) knowledge is required. 


Context of this Document 


Between 2019 and 2021 Niche was commissioned to undertake an independent investigation into 
urology services delivered by the University Hospitals of Morecambe Bay NHS Foundation Trust 
(UHMB). This document has been developed to support the information already provided within 
the investigation report (below) in order to clarify allegations made through various channels about 
the evidence, transparency and independence applied through our work. 


It is the view of Niche that, in not correcting the record surrounding these opinions and allegations, 
there are two serious consequences. One, that whistleblowing as an important mechanism for 
patient safety will be undermined; and two, that public confidence in independent investigations 
and inquiries will be diminished. 


The UHMB investigation was a unique case and involved a number of factors that led to the 
failings in the provision of care within the urology department; these are detailed within our full 
report available at https:/Awww.england.nhs.uk/north-west/wp- 
content/uploads/sites/48/202 1/1 1/Final-Independent-Investigation-Urology-Report-University- 
Hospitals-of-Morecambe-Bay-NHS-Foundation-Trust-24-N. pdf 


The availability of the mechanism of whistleblowing remains an important facility within the NHS. 
However, there are particular characteristics of the UHMB case which are difficult to consider as 
simply the consequences of whistleblowing. There is significant other learning in relation to 
managing team dysfunction, how organisations deal with inter-personal grievances, matters of 
conduct, potential racism, issues with clinical pathways, and establishing effective incident 
reporting and governance frameworks. 


The purpose of an independent? investigation is to safely surface the truth based on the evidence 
available. We acknowledge that not all parties may want to agree with those findings, and it can be 
difficult to be presented with an objective, evidence-based assessment that conflicts with a 
person’s subjective evaluation. 


Background to the University Hospitals of Morecambe Bay Urology Investigation (UHMB) 


In May 2015, HM Coroner held an inquest into the death of a patient under the care of urology 
services at UHMB; this case later became known as ‘the index case’. There were two attempts 
made by the Trust to review the care received by the index patient following that inquest. First, an 
internal Root Cause Analysis (RCA) investigation (the evidence of which was disputed by one of 


’ https://Awww.nicheconsult.co.uk/ 
? https://www.nicheconsult.co.uk/insights-updates/ 
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UHMB’s Consultant Urologists, Mr Peter Duffy) and then sometime later, a clinical review 
undertaken by an external professor of urology (the findings of which were also disputed by Mr 
Duffy who alleged ‘bias and corruption’). 


In 2016, Mr Duffy resigned from the Trust and applied to an employment tribunal for 
underpayments and claimed he was unfairly dismissed because of his whistleblowing. The 
employment tribunal concluded that he was unfairly dismissed because of the underpayments, not 
for making protected disclosures about patient care.° 


In July 2019, Mr Duffy released the first of his self-published books in which he referred to 29 
cases where he deemed that care had been delivered on a substandard basis by his departmental 
colleagues over a 20-year period. The book also included a detailed account, from Mr Duffy’s 
perspective, of the care provided to the index patient. 


In November 2019 Niche was commissioned by NHS England to undertake a wide-ranging review 
of urology services at UHMB?% including to: 


e Assess the current safety of the urology service; 

e Look at the culture of the department and address serious allegations of racism between the 
consultant body; 

e Look back at a broad range of clinical outcomes to assess the quality of care over the last 20 
years (an extensive timescale). This initially included an assessment of all of the 29 cases 
raised by Mr Duffy in his book, and any other cases of concern; and 

e To undertake a re-review to assess whether resultant improvements had been made. 


Niche was also asked to independently re-investigate the index case in order to address 
allegations of bias, and to assure the family of the index case that a thorough review had occurred. 


As part of our work, we examined thousands of documents, reports, emails, and items of data. We 
undertook over a hundred interviews and conducted service visits and observations. We also 
spent a significant amount of time with Mr Duffy, and several patients and families of those who 
had been harmed. The independent investigation found significant failings within the department 
which verified many of the concerns raised by Mr Duffy. However, the independent investigation 
also found inconsistencies in 16 of the 29 cases which Mr Duffy highlighted in his book, based 
upon his recollection of events over 20 years. 


The index case and emergence of previously unlocated emails 


In our review of the index case, we examined the care record in detail to construct an accurate 
chronology of events. In doing so, we found a reference within the margin of a clinical entry, 
written by Mr Duffy, saying ‘email sent’. 


We had not previously been provided with the email and so asked the Trust for any email sent 
which corresponded with the clinical entry, giving them the specific date and time. We were 
provided with that email the following day, which, it transpired, had been sent to two waiting list 
clerks by Mr Duffy and copied to his consultant colleagues; the email subject header was ‘urgent 
for Tuesday’. We submitted a second specific request to establish if there had been a response to 
that same email. A further email was then found in three email accounts (archive and deleted 
items folders) of the other departmental consultants as cc’d, where they had been stored for over 
5 years. These emails contained significant information relating to the events. Niche then followed 
up with a range of queries to understand how the emails had not been found before. 


3 Duffy v UHMB ET 2404382/2016 and 2406078/2016 available here: 
https://assets.publishing.service.gov.uk/media/5b6c3c41e5274a2994c75d66/2404382-16_2406078-16_18-05-18.pdf 

4 https://www.england.nhs.uk/north-west/wp-content/uploads/sites/48/2021/1 1/Final-Independent-Investigation-Urology-Report- 
University-Hospitals-of-Morecambe-Bay-NHS-Foundation-Trust-24-N. pdf 
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When examined along our clinical timeline, the second email confirmed that there could have been 
an earlier intervention by Mr Duffy himself, which might have provided a better outcome for the 
index patient (although this cannot be definitively known). The email suggests a contrary chain of 
events to that described by Mr Duffy in his book and in prior statements from all parties involved. 


The emails were brought to the attention of Mr Duffy in October 2020, following which, he accused 
the Trust of fraud and evidence tampering (please see 1.19 to 1.20 for further actions taken by 
Niche). Mr Duffy now cites that evidence as ‘disputed’ thereby discounting the reliability of the 
investigation report. 


The Allegations 


A number of allegations have been made in relation to the independent investigation at UHMB via 
journalists, at speaking events and through social media. Allegations have also been raised by Mr 
Duffy with local MPs, the Police Cyber Crime Unit and to the Parliamentary Health Select 
Committee on cyber security. The main allegations are as follows: 


(i) the emails which were provided to Niche had been ‘faked’ because they had not previously 
been found following other requests; they suddenly ‘popped up’. 

(ii) Additionally, Mr Duffy’s email account had been deleted, the emails didn’t exist in recipients 
accounts, and, different versions of the emails exist, therefore, they are fake. 

(iii) There is an ‘executive witch hunt’ against whistleblower Mr Duffy and the ‘fake emails’ are an 
example of how this is being executed. 

(iv) Niche has withheld vital evidence which is in the public interest and has not been transparent. 

(v) Niche lacks independence and is an example of ‘the NHS investigating itself — including the 
grossly misleading indication by one reporter referring to this case particularly, that Niche has 
been paid 5 million pounds by the NHS. 


Responses to the Allegations: 


The emails found were faked or there has been evidence tampering 


Whilst we have aimed to simplify the findings below, we recognise that the substance of the 
findings is technical; this complexity has contributed to the misinformation in circulation, that the 
emails have been faked. Niche has extensive primary evidence to support the statements below. 


When Mr Duffy initially raised his concerns, Niche commissioned two expert cyber security 
reviewers, working on a blind basis from each other to provide an opinion on the genesis of the 
emails. These were subcontracts of Niche, for our own reliance, in fulfilment of the contract to 
provide investigation services. 


The cyber security firms were sent the two emails in question and their headers. As part of the 
further work a wide range of other data was requested to clarify the environment in which the 
emails were sent. This included reviewing other emails sent prior to and post the emails in 
question to compare the relevant technical data on the same basis. They were asked to: 


e review reports relating to security (including IT audit, penetration testing, third-party 
assurance certification, email server and environment, archiving in place, migration to 
Office 365, access to mailboxes, authentication to the email server, remote access, 
security in place) dated from 2014 to understand the security and IT environment. 

e review the emails received to gather name of the sender, IP address of the sender, 
origination of the email). 

e review the process followed to conduct the search of emails through a live demonstration. 

e explain why there are differences in timings on the emails received in different accounts. 


The (very) summarised findings concluded that: 


e There was clear evidence to indicate that the consultant in question was logged onto Trust 
systems (through the EPR) shortly before and after the emails in question were sent and 
the emails were sent from the same IP address. 

e The consultant in question was, according to EPR logs, present on Trust premises on both 
days. The electronic medical records of the index patient were accessed early on the 
evening of 29 December 2014 shortly after the email was sent. This is timed as being at 
17:10:03 to 17:10:13. 

e The specific clinical information contained within the email of 29 December 2014, sent by 
Mr Duffy, is consistent with the contemporaneous entry in the medical records. 

e The emails still existed in the new Office 365 environment in the mailboxes of current 
consultant employees who were copied into the emails at the time. 

e There was no evidence of hacking, forgery or external tampering. 

e There was more than one version of the emails in circulation following the email and 
headers sent by the Trust and that from the GMC. One version states the email of 26 
December 2014 is timed as 16:55 but another at 16:54:47. The email of 29 December 
2014 is timed as 16:02 but another is at 16:01:41. We understand that different computer 
settings use either hours and minutes or hours, minutes and seconds, rounding up also 
occurs. Therefore, depending on the settings of the computer being used, slightly different 
versions of the times of the emails exist. 


1.22 The emails in question did not, at any point, ‘pop up’ in an unsolicited manner; a specific search 


1.23 


1.24 


was requested by Niche to support our detailed clinical review work. The key reasons why the two 
emails were not found at the time of tribunal or previous investigations are summarised as: 


e One email fell just outside of the date ranges of previous searches; 

e The email search headers were not included in previous parameters; the new search 
parameters included the headings ‘urgent for Tuesday’; 

e The references (naming conventions) to the patient were inconsistent in previous search 
requests; and 

e The Trust upgraded its system in December 2019 (after the tribunal) to Microsoft 365 which 
allowed far greater search capability on archived emails once we had commenced our work. 


Mr Duffy’s email account had been deleted in 2017-2018 because he was no longer employed by 
the Trust (there had previously been an embargo on deleting spent accounts during the Kirkup 
Inquiry). However, this did not prevent proper analysis of the emails because it was possible to 
access other email accounts where the recipients had been copied in and who were still under the 
employment of the Trust. 


Withholding of evidence 


It is important to understand that Niche was engaged by NHS England to examine departmental 
failings. Our mandate and purpose are not to assign blame to any one particular individual or 
individuals, but to help departments to examine and identify where problems arose, what could 
have been done differently and to make recommendations for patient safety and future learning. 
Niche was not engaged by NHS England to support the referral of any medical professional to the 
General Medical Council (GMC). The output of its investigations was and is not intended for such 
referrals, or for any official investigation or proceedings that could lead to disciplinary action. 


As independent investigators we also do not disclose our working papers. We have been asked to 
form a judgement using the evidence available to us although it is our job to clearly cite the basis 
of that evidence within our findings. All evidence is kept securely on our files and the integrity of 
our processes of compliance are externally audited once per year. We must apply reason and 
responsibility to how we treat evidence, for example, interview evidence. There are very good 
reasons why we do not make our evidence publicly available. If the people being interviewed were 
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not confident that their information would be treated safely, then they would be reluctant to assist 
us by providing a frank and honest account, which in turn would prevent a thorough investigation. 


Niche has been accused of hiding ‘secretive reports’ into the Trust’s cyber security. Niche is 
neither the data controller of the emails nor data controller of the expert reports, this means that 
we do not have propriety on further distribution of reports of which we are neither the author nor 
the owner. To emphasise this, the GMC asked Niche to share the Cyber security reports with 
them, but we were unable to do so because of those contractual obligations, and also because 
this action fell outside of our terms of reference. We advised the GMC to secure other independent 
advice so that they, in turn, could rely upon the emails for their own regulatory purposes (as their 
purposes were different to our purposes), we understand that such a review was not 
commissioned. 


Transparency and Independence 


Niche has met the high standards required not only for ISO:9001:2015 certification, and Cyber 
Essentials Plus, but also BCorp® (Benefit Corporation) certification. We have also met and 
exceeded the standards required to bid for work on various public sector ‘frameworks’® which is 
how we derive most of our work. Public sector frameworks are designed to ensure probity around 
contracts awarded to suppliers who must meet stringent standards and expectations as to value 
for money. 


It has been stated in the media, in line with this case, that Niche has earned £5million. This is 
grossly misleading and seeks to undermine our independence. It must be noted that Niche is not a 
party with either a direct or indirect financial interest in the elongation of this case. 


We would like to make clear that Niche has done its utmost to be transparent with Mr Duffy. We 
provided him with a near verbatim account of what the IT reports say, as have NHS England. The 
Trust also provided the raw source data to the GMC. Niche shared the IT reports, with suitable 
redactions, with the Police Cyber Security Unit in responding to the allegations of criminality. The 
police reviewed the IT reports and decided not to take Mr Duffy’s case forward. 


As a company we have maintained that we would be happy to submit ourselves to an external, 
independent legal review of the handling of this investigation, and to validate the process used to 
determine the integrity of the two emails. 


Summary 


Niche remains fully confident in the reliability of the emails used as evidence in the independent 
investigation and are equally confident in the findings. We also remain confident in the steps taken 
to validate both the emergence of the emails and the probity of the emails for the purposes for 
which we were commissioned. 


Niche agrees that there should be clear system of accountability in independent investigations and 
inquiries, particularly around use of public funds. However, the process of independent 
investigation should be allowed to proceed without fear or favour, and particularly without 
inaccurate and misleading information being presented in the media. That information is presented 
frequently as ‘fact’ but the investigation findings, are based upon evidence. 


The single, most important matter in this case, is the that the Trust has now made (and continues 
to make) demonstrable, and evidence-based, improvements in relation to patient safety and team 
culture within the urology department’ and continuing this progress, in our view, should be the 
overwhelming legacy of this case. 


5 https://www.bcorporation.net/en-us/ 
5 https://www.crowncommercial.gov.uk/news/what-is-a-framework-procurement-essentials 
7 Niche UHMB Assurance Report available on request 


